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We propose an extension of Hybrid I/O Automata (HIOAs) to model agent systems and their implicit 
communication through perturbation of the environment, like localization of objects or radio signals 
diffusion and detection. To this end we decided to specialize some variables of the HIOAs whose 
values are functions both of time and space. We call them world variables. Basically they are treated 
similarly to the other variables of HIOAs, but they have the function of representing the interaction 
of each automaton with the surrounding environment, hence they can be output, input or internal 
variables. Since these special variables have the role of simulating implicit communication, their 
dynamics are specified both in time and space, because they model the perturbations induced by the 
agent to the environment, and the perturbations of the environment as perceived by the agent. Parallel 
composition of world variables is slightly different from parallel composition of the other variables, 
since their signals are summed. The theory is illustrated through a simple example of agents systems. 

1 Introduction 

Many modern complex systems represent agents interacting to achieve a common goal, but reacting in 
an independent way to external stimuli, following an autonomous decision policy and coordinating using 
communication. When and where communication fails, the agents need to feel the environment reacting 
to its stimuli. This is the case, for example, of agents performing a search mission, such as UAVs [8] or 
autonomous underwater vehicles [5 ], but also of road traffic problems Ifl4l[l5l and autonomous straddle 
carriers in harbours ifTTI . These multi-agents problems have been case studies of the European Project 
CON4COORD (EU FP7 223844) and have motivated the modeling formalism presented in this paper. 
Indeed what is common to each case study is the presence of a collection of agents that communicate and 
coordinate to achieve a common goal. Moreover the agents move within an environment that changes 
dynamically and detect each other's presence not necessarily via direct communication but rather by 
observations of the environmental changes. 

We focus on automata-based representations of hybrid systems 10 [Q, adding features to a model, 
in order to keep as much as possible of the underlying theory. Since the motivating case studies need 
to satisfy some compositionality properties, we choose to start from Hybrid I/O Automata (HIOAs) of 
ifTOl . for which strong results on compositionality exist. We add features to represent faithfully situations 
where a hybrid automaton exists within an environment and derives information about other automata 
by observing the environment itself, rather than by using any form of direct communication. We will 
call the exchange of information through observation implicit communication. Indeed groups of agents 
usually need to know the environment where they live and move to collect and elaborate data and react 
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2 Modelling Implicit Communication in Multi-Agent Systems with Hybrid Input/Output Automata 

in a coordinated way. To do this, they need to exchange stimuli with the surrounding environment, by 
observation and using sensors. Usually the communication between agents acting in a certain area is 
achieved using artificial machineries, such as supervisors or broadcasting signals. Our aim is to avoid 
any kind of artificial machinery to model communication between agents and their interaction with the 
environment, using a more natural method, based on the human perception, i.e. through observation of 
the changes in the surroundings of each agent. Moreover direct communication is not always possible, 
since signals are subject to noise and environmental hostilities, or sometimes it is not the best policy, 
because sending signals means being intercepted, not considering faults and failures in senders and 
receivers. Autonomy in making decisions and exchanging information based on the sensing of the reality 
can be used as a redundant and a faster way of communication. To achieve implicit communication, we 
extend the HIOAs by specializing some variables, called world variables. They take values both in space 
and time, i.e. their values are indeed functions of time and space, as occurs in diffusion equations and 
they represent all the information exchanged between the environment and the agents. World variables 
represent maps of the changes in the environment as perceived by the agents: at each point in the space 
and each instant of time their values show the situation that can be sensed by agents standing in that 
area. To this end, world variables are partitioned into input and output variables: input world variables 
represent the observations made by the agents sensing the environment, output world variables represent 
stimuli given by the agents to the environment. To keep the theory consistent with HIOAs, all the results 
on semantics are preserved. Moreover we introduce parallel composition using rules similar to the ones 
for HIOAs, i.e., automata are synchronized on common actions and shared variables, except for output 
world variables, whose stimuli are summed because their effect on the environment is common. 

At the best of our knowledge, there are only a couple of approaches to the presented problem. One 
has been introduced in [ 6 ] where dynamic networks of hybrid automata are studied. The introduced 
programming language focuses on dynamical interfaces. Another method has been presented in |[T3l 
where a compositional interchange format (CIF) defined in terms of an interchange automaton is used 
as a common language to describe objects from the different models for hybrid systems existing in 
literature. None of these two languages is based on the idea of implicit communication coded by world 
variables. Our approach is a starting point to solve the problem of dynamical interfaces in a simpler 
way than the ones proposed. Nevertheless at the current status of our work the presented approach does 
not solve this problem, even though we started from it. We choose to extend HIOAs because of the 
underlying compositionality theory and because of the input/output distinction of the variables, which 
we keep in our description. Many other representations of hybrid automata could be used as basis and 
extended similarly looking at the main theoretical results they have been introduced for. As an example 
the cited hybrid automata in (H are more focused in reachability issues, but have been studied also for 
decidability in |7]. As stated in [10] Hybrid Automata (HA) presented in HI are similar to HIOAs in 
their combined treatment of discrete and continuous activity, but their theory does not address system 
decomposition issues such as external behavior, implementation relationships and composition. These 
issues have been addressed in (3j by using hybrid reactive modules, but they still differ from the way 
they are faced by HIOAs, because reactive modules still communicate via shared variables, not via shared 
actions. Summarizing, the choice of the HIOA model has been motivated by the fact that their application 
is more suited for the kind of agent systems and scenarios under study. Indeed the communication via 
explicit actions, similarly to discrete event automata, is used to model signals communication, while the 
possibility to trace an external behavior catches the interaction with the environment, which is the basic 
aim of extending the original formalism with world variables. 

The paper is organized as follows: in Section [2] we introduce the modeling framework; in Section [3] 
we show and recall the main results on semantics of the proposed model; in Section [4] parallel compo- 



M. Capiluppi and R. Segala 



3 



sition of the presented automata is described, showing the main results on composability. The theory is 
illustrated throughout the paper with a simple example, the interested reader can find a more complex 
and realistic application in [il 1 ]. All the results presented in the paper use the notation of iflQl . 



2 HIOAs with world variables 



Example 1. Consider a sandy area where two cars move, as in Fig. 1(a) We subsume an underline 



metric space M . When a car takes a certain position, its pressure provokes a depression of the ground 



(fig. 1(b)). Hence the car changes the characteristics of the environment in a permanent way, since sand 



retains the shape. The other car is, then, able to see where a car has moved (fig. 1(c)). We aim at avoiding 





(a) A sandy area with cars. 



(b) Level of the ground. 



(c) A car moving from a point to an- 
other in the sandy area. 



Figure 1 : Characteristics of the scenario 



collisions between the two cars. This might be done by equipping each car with some tools to send signals 
to the other vehicle when approaching, or adding to the system a supervisor knowing at each instant of 
time the position of both cars. We will call this kind of communication explicit. Another solution would 
be to think each car as an intelligent agent that senses the surrounding environment and is able to 
understand if the other car is too near. We call this kind of communication implicit. In other words each 
vehicle should use its sensors to catch the changes in its neighborhood and to calculate the possibility 
of another car to be in collision risk. The implicit communication is more natural to us, it does not need 
artificial machinery, it can be used even in case of hostile environments, where explicit communication 
is difficult or even impossible, but also when there is need to communicate without sending data through 
a network. Moreover implicit communication can be used as a redundant mean of communication, when 
the tools involved in explicit communication fail. 

The scenario described in Example [T] is a typical problem of coordination of agents, even though 
simplified to enlighten only the main challenges the designer has to face in finding a suitable model for 
this situation. As stated in the Introduction, we decided to use the well known framework of Hybrid 
I/O Automata (HIOAs) of ifTUl to keep the underlying composability theory, very useful in multi-agent 
problems. 

Definition 1. Hybrid I/O Automaton (HIOA) IflQl 

A HIOA A is a tuple ((U,X,Y),(I,H,0),Q,&,D,T) where 

• (U \X,Y) are disjoint sets of input, internal, and output variables, respectively. Let V denote the 
setUUXUY of variables. 

• (I,H,0) are disjoint sets of input, hidden, and output actions, respectively. Let A denote the set 
IUHU Oof actions. 
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• Q C vals(X) is the set of states. 

• ® QQis a nonempty set of initial states. 

• DC vals(X) x A x vals(X) is the discrete transition relation. 

• 7 is a set of trajectories on V that satisfy the following axioms 
Tl (Prefix closure) For every x G 7 and every x' < x, x' G 7. 

T2 (Suffix closure) For every X G T arcd every f G dom(x), X > ? G T. 

T3 (Concatenation closure) Lef To, Ti , T2, • • ■ fea sequence of trajectories in 7 such that, for each 
nonfinal index i, Xj is closed and Xj.lstate = T,-+i fstate. Then Xq Tj ^ T2 • • • G 7. 

Notation: For each variable v, we assume both a.(static) type, type(y), which gives the set of values it 
may take on, and a dynamic type, dtype(y), which gives the set of trajectories it may follow. A valuation 
v for a set of variables V is a function that associates with each variable v G V a value in type(y). We 
write vals(V) for the set of valuations for V. Let / be a left-closed interval of T (the time axis) with 
left endpoint equal to 0. Then a J -trajectory for V is a function x : J — > vals(V), such that for each 
v G V, X l v G dtypeiy). A trajectory for V is a /-trajectory for V, for any /. Trajectory x is a prefix of 
trajectory t', denoted by x < t', if T can be obtained by restricting t' to a subset of its domain. We define 
t!> t = (x \[t,°°)) — t. The concatenation " of two trajectories is obtained by taking the union of the first 
trajectory and the function obtained by shifting the domain of the second trajectory until the start time 
agrees with the limit time of the first trajectory; the last valuation of the first trajectory, which may not 
be the same as the first valuation of the second trajectory, is the one that appears in the concatenation. 
Prefix, suffix and concatenation operations return trajectories. We define x.fval, the first valuation of 
X, to be t(0), and if x is closed (J is a closed interval), we define x.lval, the last valuation of x, to 
be x{x.ltime). Given a trajectory x G T we denote x.fval \X by x fstate and, if X is closed, we denote 
x.lval \X by x.lstate. We write / \P for the restriction of function / to set P, that is, the function g with 
dom(g) = dom(f) HP such that g(c) = f(c) for each c G dom(g). If / is a function whose range is a 
set of functions and P is a set, then we write / J, P for the function g with dom(g) = dom(f) such that 
g(c) = f(c) \ P for each c G dotn(g). For more detail the interested reader can refer to ifTUl . 

The reader can notice that the main difference with respect to the model introduced by 121 [Q is that 
locations are not explicit, indeed they are given by state variables, trajectories and transitions. Moreover 
transitions from one state to another do not occur by crossing guards or leaving invariants, but they occur 
because of actions arising (see executions definition in Section [3). 

Example 2. Imagine now to describe the scenario in example [7] using hybrid automata. To represent 
HIOAs we use a variant of the TIOA language jj^j, with some extensions for hybrid systems HI2V . The 
HIOA of a car is reported in fig. [2] It has an output variable K representing the ground pressure provided 
by the car and an output variable P representing the car position. The input variables are: the level of 
the ground groundlevel as a boolean saying if the level is low (I) or high (0); the collisionrisk saying if 
another car is in collision risk (I) or not (0). A function f is defined, giving the surface of the ground 
occupied by the car area starting from its position pj and its orientation angle (f). We can imagine 
that f returns a rectangle centered in pj with orientation 0. The pressure variable is updated with a 
function z depending on the mass m and area of the car. The velocity vel of the car is if collisionrisk 
is true. Similarly the car slows down when groundlevel is true. For the sake of simplicity we used a 
boolean variable to represent the ground level changes, but any other function can be used, such as 
more general and complex diffusion equations. Note that we need to provide the system with an external 
supervisor which, taking as input the position and pressure of each car in the area at each instant of time, 
calculates the collision risk and the ground level around it. Basically the supervisor needs to know each 
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type Rad = R\2x 
hioa Car 
variables 

input collisionrisk: Bool, groundlevel: Bool 
internal 0: Rad, pj: Real 2 , m: Real, ve/:Real 
output P: Real 2 , K: Real 
trajectories 

K{t)=z{mJ^, PT )); 

{0 if collisionrisk 
0.5 if groundlevel ; 
1 otherwise. 
P(t)= PT (t). 

Figure 2: HIOA representing a car. 

car direction and position at each instant of time for calculating the possibility of a collision with other 
cars moving in the same area and the level of the ground along the trajectory the car is following. We do 
not present the design of such a supervisor because it is out of the scope of this paper. Note also that this 
is just a possible representation of the scenario described in example^ We used this simple way to show 
the need of using some external machinery (e.g. a supervisor) to model the interaction of agents with the 
environment. 

In example [2] we are not able to represent implicit communication without adding some artificial 
machinery (in this case we used an external supervisor). Since our aim is to represent the system in a 
more natural way, we extend HIOA modeling framework to catch this aspect. To do this we specialize 
some variables of the HIOA, calling them world variables. The name is due to the fact that we want them 
to represent the connection between the agents and the surrounding world. Moreover world variables 
represent the changes in the environment as might be perceived by the agents. Hence the set of variables 
V is partitioned in a set W of world variables and a set S of standard automaton variables. The set 
W is partitioned in sets (U W ,X W ,Y W ) of world input, internal, and output variables, respectively, such 
that: U w C U,X W C X,Y W C Y. To avoid confusion, we will add to automaton variables the subscript a: 

Ua i X a , Y a . 

The main difference between world and automaton variables is that the type of world variables is a 
function of time and space, not only of time as in standard automaton variables. Hence world variables 
values (and trajectories) will depend both on the instant of time and the position in the underlying space. 
Formally, if we assume an underlying topological space M, w : (T x M) — > B for every w G W, where 7 
is the time axes and B is a set. For simplicity the reader may think of M as a metric space, e.g. M 3 . An 
automaton A will use its world inputs U w to receive stimuli from the world it lives in. Analogously it will 
use its world outputs Y w to give stimuli to the world it lives in. Finally internal world variables X w are 
used to represent the world characteristics of A To keep the theory consistent with previous descriptions 
of automata, all the X variables represent persistent characteristics of the system. We will call HIOAs 
with world variables HIOAWs. 

Example 3. We now represent the car in fig. ^with a HIOAW, extending the TIOA language to include 
world variables. Note that world variables are always described using their trajectories in time and 
space, i.e. they are described for any instant of time t and any point in space p. Each car is represented 
by a HIOAW as in fig. [3] It has an output world variable k representing the ground pressure provided by 
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the car and an output world variable representing the car color § . The input world variables are: the 
level of the ground g and its color c. Each car perceives the ground level through a boolean variable g 
saying if the ground is low (I) or high ( 0). We used the boolean representation for the sake of simplicity. 
Of course any other function, like diffusion equations, may be used. Each car can check the color of 
the ground at each point of the area by the variable c, which represents a kind of colored map of the 
area. We assume that the color variable E, takes the value black for all the points inside the car area 
given by f and white outside. The pressure variable k is updated with a function h depending on the 
mass m and area of the car, associating to each point in the area of the car the value of its pressure in 
time, and to each point outside the area of the car a value. Two actions collision, level represent the 
possibility that another car is in the neighborhood and that the level of the ground in the neighborhood 
is low, respectively. Action collision activates a boolean variable stop if there is any black point p* in the 
neighborhood of the car, which is calculated by the function q returning a circle of radius r (bigger than 
the semi-diagonal of the rectangle representing the area of the car) and centered in pj, but excluding 
the area of the car given by function f. Action level activates a boolean variable slow if there is any 
point p* in the neighborhood of the car for which the ground level variable g is true, i.e. the level of the 
ground is low. Hence the velocity vel of the car is if stop is true. Similarly the car slows down when 
slow is true. All the presented equations describing the car dynamics are very simple, but the description 
of the motion is out of the scope of this paper. Indeed they can be substituted by any other equations. The 
reader can notice that in fig. [2] the position of the car is explicit in variable P, which is an output that 
must be collected by the supervisor at each instant of time to check where the automaton is in the space. 
In the HIOAW of fig. ^the position is embedded in the world variables and does not need to be explicitly 
put in an automaton variable. Indeed both color and pressure world variables carry the information 
about the position of the automaton in the space, due to their nature. 

The reader can notice that the automaton in rig. |3]has some input world variables. Here we considered 
the environment as an abstract entity, modifying and being modified by the agents living in it. As in the 
human sensing, the agents moving in an environment can catch these modifications as changes with 
respect to the nominal conditions of the surrounding area and interact with them. In the same way the 
agents change the environment. World variables aim at representing this exchange of implicit information 
because they give a map of environmental changes at each point of the space and each instant of time, 
without need of artificial machineries such as a supervisor. 

3 Semantics 

Executions of HIOAWs are defined as executions of HIOAs: an execution fragment of a HIOAW A is 
an (A, V)-sequence a = x§a\T\ail2 ■ ■ ., where a; € A, T, G T; if t,- is not the last trajectory of a, then 
Zi.lstate Xj + ifstate. An execution fragment a is defined to be an execution if afstate is a start state, 
that is, afstate G &. Results on executions of HIOAs are valid also for HIOAWs. 

A trace of an execution fragment a captures the external behavior of a HIOAW, i.e. what it is needed 
to identify an automaton from outside. Calling E = lUO,Z = UUY,a. trace of a HIOAW A is then the 
(£',Z)-restriction of a. All the results on traces on HIOAs are still valid and exactly stated for HIOAWs. 
We say that a low-level specification A implements a high-level specification H if any behavior of A is 
also an allowed behavior of S. 

Definition 2. Automata A\ and A2 are comparable if they have the same external interface, that is, if 
world and local input and output sets of variables of A\ are equal to the corresponding sets of ' A% and 
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type Rad = R\2n 
hioaw Car 
world variables 

input g: Bool, c: Color; 

output k: Real, t, : Color; 
automaton variables 

internal 0: Rad, pj\ Real 2 , m: Real, veZ:Real, nReal, stop: Bool, slow: Bool; 
actions 

hidden collision, level; 
transitions 

hidden collision 

pre 3p* G q(p T ,r,f($,p T )) s.t. c(t,p*) = black 
eff stop = true; 
hidden level 

pre 3p* € q(p T ,rJ(^),p T )) s.t. g(t,p*) = true 
eff slow = true; 
trajectories 

E(t p ) = I black if P e f( < i ) 'PT) . 
1 white otherwise 

k(t,p) = h(mJ((j),p T )); 

{0 if stop 
0.5 if slow 
1 otherwise. 

Figure 3: HIOAW representing a car. 



Ei = E% at all levels. If Ai and A2 are comparable then we say that Ay implements A2, denoted by 
■Ai < A2, if trace s{A\) C trace s{A2)- 

Simulation relations between HIOAWs are defined as for HIOAs in Section 4.3 of ifTOl . We report 
here the definition: 

Definition 3. Let A and T> be comparable automata. A simulation from Ato"B is a relation R C Q A x 2s 
satisfying the following conditions, for all states x \Qa — *a and x \Q-b — X3 of A and 23, respectively: 

1. Ifxji^ ®A then there exists a state £ 0^ such that Xji R x^- 

2. IfxjiR X£ and a is an execution fragment of A consisting of one action surrounded by two point 
trajectories, with a. f state = then "B has a closed execution fragment f5 with fi.f state = x^, 
trace(p) = trace(oc), and a.lstate R fi.lstate. 

3. If Xji R X£ and a is an execution fragment of A consisting of a single closed trajectory, with 
a. f state = Xji, then ¥> has a closed execution fragment j3 with f3 .f state = X3, trace(fi ) = trace (a), 
and a.lstate R [i.lstate. 

Results on trace inclusion for simulation of HIOAs are valid also for HIOAWs. We also report here 
an important corollary on simulation relations which will be used in the rest of the paper. 

Corollary 1. Let A and "B be comparable automata and let R be a simulation from A to H. Then 
traces (A) C trace s("B). 
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3.1 Padding of executions 

We introduce now the notion of padding of executions that will be used in the following proofs. 

Definition 4. A padded execution of a HIOAWA is an (AU {e},V)— sequence y = %Qa\%ia 2 % 2 a2 ■ ■ ■ such 
that if ai = s then T,-_i .Istate = X[.f state. 

Definition 5. Padding. 

We call padding of an execution a any padded execution obtained by a by extending the actions set with 
e. 

For example a padded execution of an execution a = XQa\X\a 2 x 2 a-i ... is y = ZqBZq a\X\a 2 X 2 a^ . . ., 
where Tq Tq = To- 

Definition 6. The restriction of a padded execution y to a set of actions A 1 and a set of variables V is 
the (A' ,V')-restriction ofy. 

Lemma 1. Let y be a padded execution of A. Then there exists (X, execution of A, for which y is a 
padding. 

Proof. Let A, V be the sets of actions and variables of A, respectively. Then, by definition of restriction 
of padded executions and by definition of executions, a = y [(A, V) is an execution of A. By definition 
of padding y is a padding of a. □ 

Lemma 2. Let a be an execution of A defined in (A, V) and y a padding of a. Let A' CA,V'C V, then 
a\(A',V) = y\(A',V). 

Proof. Straightforward by definition of restriction of a padded execution and of an execution and by 
definition of padding. □ 

Definition 7. A trace of a padded execution y is defined as y \(E,Z). 

Lemma 3. Let a be an execution of A and y a padding of a, then trace(oi) = trace(y). 

Proof. Straightforward by lemma [2] and definition of trace of a padded execution. □ 

Lemma 4. Let ybe a padding of a, execution of A, and let y 1 be a prefix ofy. Then y 1 \{A,V) is a prefix 
of a. 

Lemma 5. Given n executions, it is always possible to find n paddings of these executions such that all 
corresponding trajectories have the same length. 

4 Parallel composition 

In this section we introduce parallel composition for HIOAWs. First of all some compatibility conditions 
have to be stated. 

Definition 8. Two HIOAWs A\ and A2 are compatible if 

1. (f/ w iuc/ w2 )n(y vv iuy w2 ) = 0. 

2. H 1 nA 2 =H 2 nA 1 = 0, 

3. x l nv 2 = x 2 nv l = 0, 

4. O y C\0 2 = ®, 
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5. Y l nY 2 = <d. 

The reader may notice that conditions 2 to 5 are the classical compatibility conditions for HIOAs. 
The first condition states that no explicit communication between the two HIOAWs is possible via world 
variables. Indeed, by definition, explicit communication between HIOAWs occurs only via automaton 
I/O variables, whereas world variables are used for implicit communication. These conditions, when not 
satisfied by the HIOAWs, can be obtained by changing variables names. 

Definition 9. Parallel composition 

If A i , A 2 are two compatible HIOAWs, then their composition A\ \ \A2 is defined as the structure A where: 

1. U w = U w i U U W 2, X w = X w \ UX w2 , Y w = Y w \ U Y w2 

2. Y a = Y al U Y a2 , X a = X al UX a2 , U a = (U al U U a2 ) \ Y a 

3. = OiU0 2 ,I = (h U/ 2 ) \OandH = H l UH 2 

4. Q = {xe vals{X) \ x\X[ e Qi Ax \X 2 G Q 2 } 

5. © = {x G Q I x \X X G ©i Ax \X 2 G 2 } 

6. D = { (x,a,x') I for each / G {1,2} either a G A, and x \Xj x' [X,, ora£ Aj and x \Xj = x' |~X ( -}. 

7. 7 = {t I there exists Ti G Ti , T 2 G T 2 such that T | (V { \ {Y w \ n Y w2 )) = T,- 1 (V,- \ (Y w \ n Y w2 )), i G 
{1,2} and % \. {Y wl n Y w2 ) = Tj | (Y wl n Y w2 ) + T 2 | (F w i n F w2 )} 

This definition of parallel composition is very similar to the one for HIOAs. The only two differences 
are given by the first and the last conditions. The first condition depends on compatibility: there is no 
communication between the two HIOAWs via world variables. The last condition indeed is the main 
difference with HIOAs composition. It might be that the two composing automata have some output 
world variables with the same kind of information for the external world. These output world variables 
will have the same name and then their intersection is not empty. For those variables it is necessary 
to sum the trajectories as defined in the following. We call sum any generic operator with the same 
characteristics of the sum in R. In the following we will define the sum as an additive operator in a 
group. Let To,Ti be two trajectories with the same time domain, such that: To : [0,t] — > (Vb — > and 
Ti : [0,t] — > (Vi — > T>), where Vb, V\ are sets of variables. Let D be a domain of values for variables in 
Vo, Vi (e.g. M), such that its structure is a (commutative) group S, with an operator +<j and an identity 
element called Og- Note that the subscript G will be omitted when it is clear from the context. 

Definition 10. The sum of To, ?i is defined as: 



(Xb + Ti)(0(v) = 



tKO(v) i/v€v;-\Vi_i 
tb(0M + Ti(0(v) jfvevbnvi 



For the sake of simplicity in the following we will consider the operation of sum in M. But all 
the results presented in this paper are still valid using any other operator with the same mathematical 
characteristics. 

We report here some lemmas on trajectories that will be used in the following proof. 

Lemma 6. Let % he a trajectory in V. Let I C dom(l) and V' C V. Then (t |7) 1 V 7 = (t 1 V) |7. 

Lemma 7. Let % he a trajectory in V. Let V C V. Then (t > t) | V = (t I V) > t. 

Lemma 8. Let z be a trajectory in V such that X = To " ?\ " T 2 ^ . . .. Let V' C V. Then (to ^ Ti ^ T 2 
. . .)| V = (To I VT (Ti I V')^ (T 2 1 . . .. 



10 Modelling Implicit Communication in Multi-Agent Systems with Hybrid Input/Output Automata 



Proposition 1. The composition of two HIOAWs is a HIOAW. 

Proof. We show that A\ \\A 2 satisfies the properties of a HIOAW. Disjointness of the U,X, Y sets follows 
from disjointness of the same sets in A\ and A 2 and compatibility. Similarly for the actions. Nonempti- 
ness of starting state follows from nonemptiness of starting states of A\ and A2 and disjointness of X\ 
and X 2 . We verify the T properties of trajectories (see definition [T]). Let C\i be Y w \ n Y w2 . 

TI We want to prove that for every % G 7 and every t' < z, %' G T. Let T be a trajectory in T. Let 
i G {1,2}. By the definition of parallel composition there exists T\ G Ti , T 2 G T 2 such that T 4 
{Vi \ C12) = T; 4 (V; \ C12), and T 4 C J2 = Ti 4 C\ 2 + T 2 4 Ci 2 . Let t' < X. By definition of prefix we 
have that %' = % \1 with / = dom(z') C dom(x). Hence we can state that t' 4 (V,- \ C12) = (t [/) J, 
(V;\Ci 2 ). By lemma(6](T |7)4 (V*\Ci 2 ) = (?\- (V,-\Ci 2 )) \L By definition of parallel composition 
and again by lemma§(T | (V/\Ci 2 )) |7 = (t,- | (Vi\Ci 2 )) |7 = (T; \t) 4 (Vi\Ci 2 ). Let t{ = Ti [/ 
and T 2 = T2 ["/, then (t,- [/) 4 (Vi \C\ 2 ) = t/ 4 (V; \Ci 2 ). Analogously, for the second statement 
of parallel composition of trajectories we have that t' 4 C\ 2 = (t [/) 4 C12 = (t 4 C12) [/ = (l\ 4 
C12) |7 + (t 2 I C12) [/ = (Ti |7) I C12 + (t 2 \1) I C12 = r[i C12 + t 2 I C 12 . Hence %' G X 

T2 We want to prove that for every T G 7 and every t G dom(z), T > ? G T. Let T be a trajectory in 
T. Let / G {1,2}. By the definition of parallel composition there exists Z\ G Ti,T2 G T2 such that 
t| (Vj\Ci 2 ) = T;| (V;\Ci 2 ), and t|Ci 2 = Ti |Ci 2 + t 2 |Ci 2 . Hence, since dom{%\) =dom(r 2 ) = 
dom(z), by lemma|7]we have that (r>f) 4. (V-C l2 ) = (t4 (V-Ci 2 )) >t = (t; | (Vj-Ci 2 )) >t = 
(T > I (V; - C12). Moreover (t > t) | C 12 = (t | Ci 2 ) > t = (ti 1 C 12 ) > t + (t 2 4 C 12 ) > t = 
(Ti > t) 4 Ci 2 + (t 2 !> ?) 4 C12. Recall that by the properties of trajectories T > ? is still a trajectory. 
Hence T > f G T. 

T3 We want to prove that set 7 is closed under concatenation. Let To, 1\ , T 2 , . . . be a sequence of trajec- 
tories in T, such that, for each nonfinal index j, Tj is closed and Tj.lstate = Tj + \.fstate. Let T be 

To Ti T2 Let i G {1,2}. By definition of parallel composition for each Tj, 3ti 7 -, T 2; - such 

that Tj I (V \ C12 ) = Zij 4 (Vi \ C12) , and Tj 4 C12 = Ty 4 C n + T 2 j 4 Ci 2 . Let T, be T; ^ Ti ^ T 2 "\ . . . 
Hence by lemma [8] T 4 (V; \ C 12 ) = (t 4 (Vi \ C n )) ~ (Tj 4 (V/ \ C 12 )) ^ (t 2 4 (V, \ C l2 )) 
(t/o 4 (Vi \ C12)) ~ (Tn 4 (V5 \ C12)) ^ (t,-2 4 (V \ Cn)) ~ ... = (To ^ Ti ^ t,- 2 ^ . . .) 4 (V, \ C n ) = 
T; 4 (V \ C12). Moreover T 4 C l2 = (t 4 C i2 ) ~ (Ti 4 C i2 ) ^ (t 2 4 C 12 ) ^ . . . = (Ti 4 C12 + T 20 4 

Ci 2 )~(Tn 4Cl2 + T2l 4 C12) ^ (T12 4 C12 + T 22 4 C12) ^ • • • = ((T10 4 C12) ^ (Tn 4 Q2) ^ (T12 4 
C12) + ((^20 4 Q 2 ) ~ (T21 4 C12) ^ (T 22 4 C12) = (TlO ^ Tn ^ Ti 2 ^ . . .) 4 Ci 2 + (t 20 ^ 

T 2 i ^ T 22 ~ ■ ■ •) 4 C n = Ti 4 Ci 2 + T 2 4 C i2 . Hence T G T. 

□ 

Example 4. Consider again example^ Suppose to have a HIOAW representing a car as in fig. ^in the 
sandy area, called Si. Another car represented by r B 2 (again of type represented in fig. [?]) enters the 
sandy area. We want to compose the two cars. Variables and actions ofS>\ are labelled by the subscript 
1, the ones of"B 2 by the subscript 2. The obtained HIOAW Hi ||I> 2 is represented in fig. |?j Notice that the 
effect of the output world variables are summed: the ground pressure kof r B[\\'B 2 represents a sort of a 
map of the values taken by the pressures given by the cars in the considered area, the same for the color 
Indeed here we did not make any constraints of two cars being at the same point at a time, because 
the model can take into account also collisions. 

We now show that simulation relation and trace inclusion are preserved by composition. The main 
difficulty compared to the analogous results in ifTOll is that output world variables sum their effects. This 
means that it is not possible anymore to project executions of a composite system to obtain executions 
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of the components. Rather we have to show that for each execution of the composite system there are 
executions of the components that can be pasted together. 

hioaw Si ||^2 
world variables 

input g: Bool, c: Color; 

output k: Real, £ : Color; 
automaton variables 

internal (j>i: Rad, pj\. Real 2 , m\\ Real, ve/i:Real, n:Real, ^2' Rad, pj2- Real 2 , m2'. Real, vefoReal, 
r2:Real, stopi: Bool, stop2: Bool, slowi: Bool, SI0W2: Bool; 
actions 

hidden collision], collision2, leveli, leve^; 
transitions 

hidden collisioni 

pre 3p* G q(p T i,n) s.t. c(t,p*) = black 
eff stopi = true; 
hidden collision 

pre Bp* G q{pT2ji) s.t. c{t,p*) = black 
eff stop2 = true; 
hidden leveli 

pre 3p* G q(p T i,ri) s.t. g(t,p*) = true 
eff slowi = true; 
hidden leveb 

pre 3p* G q{p T 2,r 2 ) s.t. g(t,p*) = true 
eff SI0W2 = true; 
trajectories 

?U „) = / blaCk if P^f(h,PTi)^P&f(^>2,PT2) . 

1 white otherwise 

k(t,p) = h\miJ(<$>\,pT\)) + h(m 2 J{<h,PT2))\ 

{0 if stopj 
0.5 if slowi 
1 otherwise. 

{0 if stop 2 
0.5 if SI0W2 
1 otherwise. 

Figure 4: HIOAW representing parallel composition of Si and S 2 . 

Lemma 9. Let A = A\ WA2 and let a be an execution fragment of A. Then 3a\ , (#2 execution fragments 
of A\ and A2 respectively, such that 

1. a r(A,-,V;-\Ci2) = Oi \(Ai,Vi\Cn),i = l,Z and 

2. a [(0, C12) = cci [(0, C12) + a 2 [(0, C n ), 
withC l2 = (Y wi nY w2 ). 

Proof. Let a = X§a\%\a2%2a-i . . . G frags A . By definition of parallel composition, since each Tj G T there 
exists T/i G 7i , x j2 G T 2 such that: Zj | (Vi \ C 12 ) = Tji I (Vi \ Cj 2 ), t,- | (V 2 \ C l2 ) = z j2 | (V 2 \ C i2 ) 
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and Zj I Cu = Tji 4 C\ 2 + T/ 2 4 C\ 2 . Hence by definition of padding we can build two padded executions 
Yi = Toia 1 Tna 2 T2ifl , 3 . . . , 72 = To2«i'Ti2«2 T 22fl , 3 • • • of A\ and A2 respectively, where 



Zj ifdj£A\ I, J fly if Clj£A2 

i 1 £ otherwise ; 1 e otherwise 



Let i G {1,2}. By construction of 7 it is a \(Aj,Vi\Cn) = Yi \(Ai,Vj\Cn)- By lemma[T]it is possible 
to define the execution a, of At for which 7- is a padding. Then by lemma|2]it holds: 7 \{Ai,Vi\Cyi) = 
a, \{Ai,Vi \ C\2) which proves point 1 of this lemma. Moreover, since the projection of an execution 
on an empty set of action gives a trajectory, we have that a |~(0,Ci2) = 7i |~(0,Ci2) + 72 |~(0,Ci2) = 



0:1 [(0,Ci2) + «2 [(0,Ci2). By definition 10 the last statement proves point 2 of this lemma. □ 

The following lemma from HIOAs applies directly to HIOAWs. The proof is reported in ifTOl . 

LemmalO. Let A = Ai WA2, and let a be an execution fragment of A. Then,fori= 1,2, trace(ot) \(Ej,Zj) 
trace(a |~(A ; , V^))- 

The following proposition relates the set of traces of a composite automaton to the sets of traces of 
the component automata. 

Proposition 2. Let A = A\ WA2 and a trace of A. Then 3/3i,/32 traces ofA\,A2 respectively, such that 

1. /3 \{E i ,Z i \Cn) = Pi\{E i ,Z i \C l2 ),i=\,2and 

2. j3 \(Q,Cn)=Pi r(0,Ci 2 ) + j8 2 K0,C 12 ), 
withC 12 = (Y wl nY w2 ). 

Proof. Let /3 be a trace of A. By definition of trace 3a G execs(A) such that j3 = trace(a). By Lemma[9j 
3a\,a 2 execution fragments of Ai and A2 respectively, such that a ["(A,-, V/\Ci 2 ) = \{Ai,Vi\C\ 2 ),i = 
1,2, and a |~(0,Ci 2 ) = ot\ |~(0,Ci 2 ) + a 2 |~(0,Ci 2 ). Let j3i = trace((X\) and /3 2 = trace(a 2 ). We want to 
prove that /? \{E u Zi\C n ) = A \(Ei,Zi\C l2 ),i = 1,2 and /3 [(0,Ci 2 ) = A K0,Ci 2 )+/3 2 \{®,C 12 ). By 
Lemma [l0} j3 ["(£;, Z;) = trace(a |~(A,-,V;)). Moreover by the properties of projection of executions, we 
have that {5 \(E u Zi \ C\ 2 ) = trace(a \{A i: Vi\C\ 2 )) and /3 |~(0,Ci 2 ) = trace(a |~(0,Ci 2 )). Furthermore 
by the properties of projection of executions we have that (a,- [(A,-, V,- \Cn)) \(Ei,Zj \ Cn) = &i |~(A;n 
E h (ViDZi) \C l2 ). Since by definition A,- n£,- = E { and V,-nZ, = Z, we obtain a, [(A,-n£;, (VjnZ,) \C 12 ) = 
trace(a) \(Ej,Zi\Cn)- Similarly for projections on Cn- D 

The next two theorems prove the results on substitutivity for implementation and simulation relations. 

Theorem 1. Let A\ and A2 be comparable HIOAWs with A\ < A 2 . Let H> be a HIOAW compatible with 
each of A\ and A2. Then A\ ||23 and A2WB are comparable and A[ ||S < A.2||23. 

Proof. Let a be an execution of A\ || S. By lemma [9j two executions (X\,a B exist, such that ai G 
execj^!), a B G execs{%) and: a [~(Ai, Vi \Ci B ) = ai [(A^Vi \Ci B ), a \(A B ,V B \Ci B ) = oc B \(A B ,V B \ 
Ci B ), a[(0,Ci B ) = ai [(0,Cib) + a B |~(0,Ci B ), with C\ B = Y w \ C\Y wB . Bylemma|5]we can take paddings 
of a,a\,a B such that the /* trajectory has the same length for all j. Let these paddings be Y,Yi,Yb 
respectively with 7= ToaiT^^aj, . . ., Yi = lQ\a\X\\d 2 %2\d-i - ■ ■ and Yb = ^ob^i^ib^^b^ ■ ■ ■■ Since 
■Ai < A2 and by compatibility, we can find an execution GC2 of A2 with the same trace of ai and a 
padding of CC2 following lemma|5] We write 72 = To2«i" T\ 2 a 2 l 22 d" .... By the definition of composition 
the execution of A2 || 23 obtained by 72 and Yb will be / = T' b\x[b2T' 2 b^ where fj J, (V 2 \C 2B ) = T)- 2 \. 
(V 2 \C 2B ), T'jl{V B \C 2 B) = Tj B l{V B \C2 B ), r' j lC 2B = rj2lC2 B + Tj B lC2B, where C 2B = F w2 ny ivB . This 
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is valid even if the trajectories in the padded executions have not the length of the original trajectories, 
by definition of prefix of a trajectory and prefix closure of trajectories in a HIOAW. Actions b[ might be 
different, but by construction, compatibility and lemma [3] we have that / has the same trace of y hence 
of DC. Indeed the (padded) executions can differ only in their internal variables (state), but they do not 
influence the traces (external variables). For this reason we can state that traces(A\ || 23) C traces{Ai || 
23 ) , hence , by definition [2] of implementation, A\ \ | 23 < Ai \ | 23 . □ 

Corollary 2. Let A\ and A2 be compatible HIOAW 's, and let R be a simulation relation between A\ and 
Ai. Let 23 be a HIOAW compatible with each of A\ andA-i- Then A\ ||23 < .A2||23. 

Proof. Since A\ R A2, by corollary [T| traces(A\) C traces{A2)- By definition [2] of implementation, 
Ay < A 2 . By theorem [T] this implies that for any 23, Ay ||23 < yL 2 ||23. □ 

Theorem 2. Let A\ and A2 be compatible HIOAWs, and let R be a simulation relation between A\ and 
A2- Let 23 be a HIOAW compatible with each of A\ and A2- Then 3 R' such that (Ai ||23) 7?' (.A2||23). 

Proof. Let R' be a relation between A\ ||23 and yi2||23 such that for each x\ G Q\, X2 G Q2, xb,x' b G Qb, 
(xi,Xb) R' (x2,x' B ) iff {x\ RX2) A (xb = x' B ). We prove that R' is a simulation relation by proving that R' 
satisfies each point of definition [3] 

1. Since for each x\ G ©1, X2 G ©2, *i RX2, then by definition of R', for each initial state (xi,xg) of 
A\ || 23 and each initial state (x2,xb) of .A2||23, {x\,xb) R' (x2,xb), with xb G ®b- 

2. Let a be an execution fragment of Ai ||23 consisting of one action surrounded by two point trajecto- 
ries, with a.fstate = (x\,xb)- Let a.lstate = (x[,x' B ). Since x\ RX2 then 3x' 2 G Q% such that^ Rx' 2 . 
Since A\ R A2, by corollary[2| A\ ||23 < ^l2||23. Then there exists /3 execution fragment of ^l2||23 
with the same trace of a and $.f state = (x2,xb). By definition of parallel composition there exists 
an action bringing the state to (x^x 1 ^. Hence by definition of R' we have that (x\,x' B ) R' (x' 2 ,x' B ). 

3. Let a be and execution fragment of Ai ||23 such that a = T G 7 closed and with a.fstate = (x\,xb). 
Let j3 be an execution fragment of ^l2||23 such that [i.fstate = (x2,xb). Let a.lstate = (x\,x' B ) and 
fi.lstate = (x l 2,x l B ). Since x\ Rx2, by definition of R' it is (x\,xb) R 1 (x2,xb). By corollary[2j there 
exists an execution fragment j8 of A2||23 with the same trace of a. 

□ 

5 Conclusions 

In this paper we have proposed an extension of the Hybrid I/O Automaton model of ifTOl to provide a 
natural representation of the fact that objects move in a world that they can observe and modify. We 
started from the analysis of the case studies of the C4C project, representing agents that move in a 
dynamical environment and have to achieve a goal by coordination. Besides the classical signals that 
automata send to each other either via discrete communication events or shared continuous variables, we 
specialized some variables of HIOAs to let them communicate implicitly by affecting their surrounding 
world and observing the effects on the worlds of the activity of other automata. This mechanism for 
interaction turns out to be adequate for compositional analysis, which is one of the main features of 
HIOAs that we wanted to keep in an extended model. Indeed we introduced the notion of parallel 
composition, and proved compositionality results. The natural extension of this formalism to model 
environment has been reported in [4] , leading to a hierarchical representation of automata and introducing 
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the ability of composing them vertically into nested worlds. We presented in this paper a toy example to 
show the application of the theory, but a more complex and reality-based application can be found in ifTTTl . 
The simulation tools are under study. Future research directions include the ability to describe scenarios 
where automata are created and destroyed and where communication links change dynamically. 
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